Shadow copy deletion
Detects destruction of recovery data — Volume Shadow Copies, system-state backups, or the Windows recovery environment (vssadmin / wmic shadowcopy…
What it detects
Detects destruction of recovery data — Volume Shadow Copies, system-state backups, or the Windows recovery environment (vssadmin / wmic shadowcopy delete, wbadmin delete, bcdedit recovery tampering). Wiping the ability to restore is a hallmark step ransomware takes immediately before or after encryption, and is high-signal on its own.
MITRE ATT&CK mapping
- T1490Inhibit System Recovery· Impact
False positives and triage
Backup software and administrators occasionally prune or resize shadow storage. A read (vssadmin list shadows) is never flagged. Deleting ALL shadows, deleting the backup catalog, or disabling the recovery environment on a workstation is a strong ransomware precursor — correlate with mass file modification and the invoking account.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 85%. Source: rules/windows/shadow_copy_deletion.yaml, licensed under the Apache License 2.0.
id: windows.impact.shadow_copy_deletion
version: 1.0.0
status: stable
severity: critical
confidence: 0.85
platforms: [windows]
mitre_techniques: [T1490]
description: |
Detects destruction of recovery data — Volume Shadow Copies, system-state backups, or
the Windows recovery environment (vssadmin / wmic shadowcopy delete, wbadmin delete,
bcdedit recovery tampering). Wiping the ability to restore is a hallmark step ransomware
takes immediately before or after encryption, and is high-signal on its own.
match:
event_category_any: [process, script]
command_line_contains_any:
- "vssadmin delete shadows"
- "vssadmin.exe delete shadows"
- "delete shadows /all"
- "shadowcopy delete"
- "win32_shadowcopy"
- "resize shadowstorage"
- "wbadmin delete catalog"
- "delete systemstatebackup"
- "recoveryenabled no"
- "bootstatuspolicy ignoreallfailures"
false_positive_guidance: |
Backup software and administrators occasionally prune or resize shadow storage. A read
(vssadmin list shadows) is never flagged. Deleting ALL shadows, deleting the backup
catalog, or disabling the recovery environment on a workstation is a strong ransomware
precursor — correlate with mass file modification and the invoking account.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.